ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A SOC 2 Type II report is issued under SSAE-18/ISAE-3000 and evaluates controls relevant to the Trust Services Criteria such as security, availability, and confidentiality. A Type II opinion covers both the suitability of design and the operating effectiveness of those controls over a defined review period (commonly 6-12 months), meeting the auditor's need for evidence of continuous control operation.

• SOC 1 Type II focuses on controls over financial reporting, not general security.
• A SOC 3 report is only a short public seal derived from a SOC 2; it lacks detailed testing results required by internal auditors.
• An ISO 27001 certificate confirms that an ISMS exists, but it does not provide the detailed control testing and period-of-time assurance that an attestation report offers.